Look into hindering the use of the API

[ctm]

Look for the best practices for hindering (or even preventing) the use of the API.

Now that the API supports the beginning of hand histories, look into what we should be doing to prevent the API from being hit when it shouldn't be. Most likely there are things we can trivially do that will at least prevent people from typing the api into their browser, but won't prevent non-browser access.

I doubt that anyone will bother hammering craftpoker.com for a while, since in round numbers nobody knows about it, but since I do plan on publicizing the site, it makes sense to not forget this.